TippingPoint has reported some vulnerabilities in Macrovision Update Service and FLEXnet Connect, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors in the boisweb.dll ActiveX control when handling the "DownloadAndExecute()" and "AddFileEx()" methods. This can be exploited to cause stack-based buffer overflows via overly long arguments.

Successful exploitation allows execution of arbitrary code.

Solution
The vendor has reportedly issued an updated version of the agent.

Provided and/or discovered by
Pedram Amini, TippingPoint Security Research Team.

Original Advisory
Macrovision:
http://support.installshield.com/kb/view.asp?articleid=Q113020

TippingPoint:
http://dvlabs.tippingpoint.com/advisory/TPTI-07-09

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area